Name: Achieve NCSC Cyber Essentials Certification with LastPass
Uploaded: 2025-03-27T14:46:46.751Z
Duration: 1 h 56 s
Description: Achieve NCSC Cyber Essentials Certification with LastPass

Transcript for "Achieve NCSC Cyber Essentials Certification with LastPass": Hello, everyone. Welcome. We see Derby, Canterbury, London, even Macedonia. Welcome to all. We'll start in two more minutes just to give everybody a bit more time. Hello again to everyone. We're just waiting one more minute to see if we have a few more people joining us. Okay. I think let's begin. Firstly, welcome to everybody. We have quite a, a nice spread around, around The UK and further beyond. My name is Sanda Nissinen. I am the security awareness lead at LastPass, and welcome to today's webinar on how to achieve your NCSC cyber essential certification with LastPass. Also joining me today is Mario Platt. He is the chief information security officer of LastPass. So we are an esteemed and expert company. Mario is an information security expert with over twenty years of experience in cybersecurity ranging from penetration testing, security operations, security engineering, governance, and leadership. So we're delighted to have him on today, and you can also, find him as a frequent speaker at industry conferences on these very topics. So let's start with today's agenda. We have lot to go through. So we will be briefly covering what is cyber essentials and cyber essential plus for anyone that is new to the scheme. Plus then we'll take a deeper dive into the five essential areas and to discuss how we prepare for certification. We'll also, mention and start to define on what it could an accurate scope be based on your requirements, and then deep diving into key issues and challenges, and effectively how to get started, and things to look out for during this process. We will be sharing resources with you, including how Last Pass can come to your aid to improve your security and get your certification. Finally, at the end, we will have a q and a session. So please do keep those questions coming in on the chat. We have the members of our security team on hand, so they will be, able to address some of the questions, in the chat. So let's get started. So what is, cyber essentials and cyber essentials plus? This is the National Cybersecurity Centre or the NCSC, which is the government arm which focuses on cybersecurity. And the Cyber Essentials scheme itself is backed by the UK government. So, really, the NCSC defines the rules and stipulates the requirements of this scheme. IASME is the accreditation body, and they administer the scheme. So they're responsible for the portal, the questionnaire that's involved, and so on. And they work with about 300 cybersecurity organizations across The United Kingdom to advise and certify organizations of all sizes. The scheme was initially launched in 2014, so we're looking at just past a decade, but this scheme is is regularly updated. As you can imagine, the threat landscape is evolving, just as our IT infrastructures are changing. Particularly, the biggest one that we've seen is is the shift to the cloud. Also, for some context for you, currently, there are over 33,000 cyber essential certifications, and on close to 11,000 cyber essential plus certifications issued. This is according to the NCSC website. So it is quite a widely adopted and recognized scheme. Just for your information, the latest update to this scheme was in April 2023, and the current version is version 3.1, which we will be referencing in this presentation. And, of course, finally, the different certification body specialize in the different verticals and different industries. So when we come to that, you are able to choose one that fits your organization and find, them listed on the ISMA website. We're speaking about, two certifications here, which is the cyber essentials and the cyber essentials plus. The cyber essentials really sets out is the basic set of security controls that organization should implement to improve their resilience. So this is a self assessment process, through a questionnaire. Whereas the cyber essentials plus, this is more of an advanced version of cyber essentials, but, the same controls and requirements, are involved. This does include a hands on technical audit and the vulnerability assessment. So it is is a more stringent, than the SC the sorry. The cyber essentials. And really thinking about which one you go for depends on how much assurance you need and what the requirements are from your business stakeholders. It's it's difficult to generalize. It really depends on the business. But, generally, we see for the cyber essentials, it is a cost effective way to improve your cybersecurity for the small and medium sized businesses, and really to demonstrate that you are handling customer data in a secure way. In addition, this is a contractual requirement for businesses bidding for UK government contracts, so that's something to keep in mind. For the cyber essentials plus, generally see that these are more larger organizations or those handling with, handling more sensitive data. So you do need that or clients who require that independent validation of the security measures. Also, companies working within hired highly regulated industries such as finance, health care, and government. So so so these are the kind of, general general, themes, and trends rather. But, also, what we see is this can be seen as a compliance journey. So often, SMBs start with the cyber essentials and then, graduating and and maturing into the cyber essentials at a later stage. What is the benefit business benefit, to to both of these certifications? Really, they are multiple. Really, fortified security. So hardening your, your business, in order to maintain that organizational resilience, and therefore, breeding trust amongst your clients and customers. Also, as a signifier of accountability to show that your organization is committed to fulfilling, these these security promises, breeding loyalty, and then expanding your business opportunities. This gives you extra credibility that that you are, at the standard, when you are bidding for those important contracts. At this point, Mario, I'd like to actually bring you in, and ask you a question on do you with these benefits that I've just explained, do you see any differences between organizations from b to c or b to b at all? Yeah. So, there's, usually, there are two types. There's a the main difference between b to b and b to c is really who you are serving. Right? So in the in the in the consumer space, usually having something like cyber essentials is a is a badge about how, diligent you are in protecting the information that you hold about your customers. Right? Because at the at the end of the day, you are protecting you are if you are doing business, if you're selling, you're likely needing to to capture and process, their personal data, of the of consumers. And the it shows that, you are taking measures to validate validated measures to, to to do a good job at handling that data and being diligent about how you do so. The on the b to b side of things, it's usually slightly different because usually you've got a you've got requirements that either come through a contract or even for you to to go through procurement teams or to go well through the third party risk management programs of the companies that you're trying to sell into. They will usually want those, they will usually have contractual clauses that require you to do things securely. And having something like Cyber Essentials, Cyber Essentials Plus, gives them, kind of a badge or an an additional validation that, that you are comfortable in being audited, that you're comfortable in showing other organizations about, how good your security measures are. That's super that's interesting perspective. I know we have a wide array of organizations on the call today, so that's that's definite food for thought for you. Let let's continue, quickly to what are these five five essentials that that, that we are, referring to. I'll just give a quick overview, and then I will pass it over to Mario who will give us a much deeper dive, into these. So these are the five essentials, with the first being firewalls and Internet gateway. So, really, this is to protect all devices, connecting to the Internet, and the requirement is for both network and devices. Second, secure, configuration to ensure all devices are configured securely. Mario will, again, will expand upon that. User access controls, who is, who has access and to what. Mario will explain two very important security concepts such as need to know and least privilege, in just a moment. And then we have patching, ensuring that, that services are running up to date, and mitigating against known vulnerabilities, and finally, malware protection. So, even though these these five are separated within this framework, but what you'll see along the process and through through Mario's, explanations that it really is a combination of these five controls that working together that make sure that you have that essential security in place. So I shall pass it over to you, Mario. Thank you very much. So with regards to the, to some of the areas, we'll look into a bit more detail on what this mean. So, I will answer the question from, from Trish, in this in the context now on the files in Internet guide ways because that's usually, as companies are becoming more remote in the with people working from home and not having physical offices, that obviously changes the scoping that you need to consider, form for your cyber essentials, certifications. So if you don't have an office, then obviously, you will not have the routers or firewalls that would typically be in the traditional office spaces, that would come into the scope. Right? But, but the same, requirements, will will still apply regarding the things that you do have. Right? So, to give you an example, instead of having to worry about the the the firewall, that, would typically sit in an office, You need to make sure that all of the either mobile devices, laptops, or others have those types of capabilities. Right? Because these requirements apply, independent of, of all of that. So the scoping will speak a bit, bit, later about scoping in and of itself. But, that's, that's the first element of of doing this type of exercise is understanding what your scope is. So specifically on the the benefits of firewalls in Internet gateways is really about understanding filtering, inbound and outbound traffic. Right? So that means that, if you've got, devices or offices, then you need to have, the ability to filter the type of traffic that, that can go inside and outside the organization. So people should not have, just, free access to anything and everything. You need to make sure that you, put rules in place such as to and there are many different ways of of meeting that requirement. So for instance, at the router or firewall, if you only need your users to do remote desktop or access web traffic, that's the the only things that you should be allowing and then denying every other type of traffic. If, on, on a local device, kind of a similar thing. You need to make sure that only the traffic that is required for business purposes is allowed through. Right? So one, aspect where sometimes this, in this speaking from a practitioner perspective, because I helped a lot of different organizations throughout my career, achieving, cyber essentials. One area that is often overlooked is, this type of control on servers. Right? If you use a cloud, etcetera. So making sure that, that you only allow access, for instance, to the websites where you're going to do the updates. Your server updates, is important as opposed to just allowing any type of free traffic, to go. Another aspect that, that I would always highly recommend is thinking in terms of management interfaces, not being exposed to the Internet if you do have routers and firewalls in your office environments. Right? So, with regards to the actual requirements within cyber essentials, if you do need to allow them, for instance, if you, have, remote staff or if you have, an IT service provider that does the the management of your routers and firewalls on your behalf, you may need to, to allow that external access. But and if you do from a a requirements, perspective in Cyber Essentials, you need to at least have either a multifactor authentication or only allow the IP addresses of those to to, to to actually connect. Now from a security posture perspective, I would still strongly advise to not have management interfaces on the Internet. Or if you do, to do something like, having someone that usually goes into the office, follow a five to seven step procedure, that they can do when the access is actually required. Because one thing that is very common, in the routers and firewalls is the a type of vulnerability that is called remote code execution. There's been a lot of them in the last few years. In the even if with those security measures like MFA and IP allow lists, you may still be exposed in case of software flaws, within those devices. So if you can, it would do wonders for your security posture to not expose those types of interfaces, to the Internet. And, so, again, disabling necessary services and protocols. And another aspect, the of something of any type of compliance exercise is that you don't just need to be doing things. You need to have written processes about how you do things. Right? So in thinking in terms of change management of when you add a rule, when you remove a rule, how are you capturing it, ensuring that the right stakeholders are approving it before changes are deployed is also, a key requirement, that needs to be, considered. And finally, the software, firewalls on the devices in interested networks. So particularly, if, you've got a remote staff, if people sometimes work from Starbucks or any other place like that, you need to make sure that there's, software on their devices such that they can be protected wherever they go. Right? And that's, yep, another element of, that needs to be considered. In terms of secure configuration, there's usually, a rule of thumb that I, that I advise, every company needs to do, which is if every time you, implement a new technology in your organization, you go to a vendor's website and follow their recommended hardening guidelines. In most software pieces these days, they will have, if you go to their website, they're gonna have, recommendations on how to harden, the, their configuration. You'd be a very good step ahead into making sure that, you will not fail on this requirement. Right? So making sure that you follow those guidelines or even if you can't for some business reason, you capture why the reason why we didn't implement one of the 10 steps that they've suggested, and they that will put you in a very good position to to ensure that you're meeting this requirement every time. Right? With that just that one simple change. Every time you do, a new technology, implement a new thing, go to the vendor's website and follow the recommended hardening guidelines. So when other things that come into into play in this requirement is changing default passwords and protecting shared initiative accounts, which is usually a problem that, that I see often in organizations that affects not only compliance, but also, the security posture, which is usually as SMBs, you'll have a very limited number of people with access to the keys of the kingdom. Right? And then you need to make sure that if one of those people leaves the organization, having a process whereby you're gonna change those passwords such that they cannot keep on having access after they leave the company. Right? And, having the ability to, share securely those kind of administrative passwords that you can't get rid of, yep, is a consideration that, that you need to have. As he's removing unnecessary software and having that process of understanding the yeah. Do we actually need this or not, in in show that you are reducing, what what is called the attack surface. Right? The amount of things that you need to to be worrying about to to to be in the position to secure your organization. In the another element here is, about locking devices and disabling things like autoplay and autorun. Right? So if you, if you have those things enabled and you put in a USB that has some kind of malware, you will immediately be exposed to it. And having those types of disabling, actions done, will protect you from some of those threats as well, locking devices. For instance, if you're away from, from the device for more than than a few minutes, in having, a good ability to, to control, how those things, then, then get implemented. So some controls, thinking in terms of locking devices is making sure that, you've got some kind of throttling. Right? So that people cannot try more than, 10 times is what the the requirement in Cyber Essentials says, in no more than 10 attempts within five minutes. Ideally, you put the those numbers a bit even lower than that if you if you can afford, but, but that's what the Cyber Essentials, says in terms of requirements. Then so that's on the the first two, areas. Another area that is very important to us, especially at at Las Bus because of, what we do is user access control. So as Sano was mentioning, there are two security concepts here that, that are really important, which is, the need to know and least privilege. So need to know, meaning that, you won't should only be granting, access to the systems that people require to do their jobs, in making sure that, in that is also not just a good security measure, but a good financial measure. Right? Because, if you do a good job at that, you'll be saving on numbers of licenses that you need across the company. So there are other benefits, not just security, at being diligent in, in approaching that. Then there's also the element of least privilege, which is a particular challenge for SMBs. Right? So SMBs, by the very nature of their size, people tend to wear multiple hats, and it's sometimes very hard to to understand to to apply the least pre principle because people do a lot of different things. But it is something that you need to take, account for, And, things such as making sure you've got a at a minimum, things like read only roles, and, things like, limited change roles that can do some changes but not administer the platforms and having admin roles really just for those key individuals that are going to be, administrating, policies and changing, the the systems themselves. So that will already put you in a in a good position to to have the set requirements. Making sure that everyone has named accounts, so not using generic accounts that you can't map, back to, to specific people. In the again, the part on process. Right? Process is extremely important for any compliance exercise con creation and deletion and making sure that you can show the paper trail, when the auditors come in. And then enabling multi factor authentication, is, is a requirement as well, where possible. Strong password creation policies, which, is something that we'll speak later. But, having strong passwords is something that LastPass, can help with and making sure that you implement those password complexity policies that will help ensure that everyone has strong passwords without having to know them, which is the ideal scenario. And, you should always try and favor the use of SSO. Right? Because that means that it's less accounts to manage. If you have 50 different SaaS applications in these days, everyone has hundreds of SaaS applications. So 50 is probably on the low side even for an SMB. So if you connect them all to SSO, it means that when you remove the SSO account, the main identity of people, all of those other accounts will be deprovisioned as well. If not, you need to account for the differences in process between what is SSO enabled and what is not SSO enabled, and that adds a lot of, operational complexity, to your organization as well. And then separating admin from non admin accounts. So this is something that over the last few years has become, a bit easier, with things such as in entry ID. You can now assume roles. So admin, admins can have their usually named accounts and then just assume a more privileged role for a for a period of time. You can say it's for four hours or whatever that may be, and you're actually forced to, to capture the reason why you're doing so. Right? So that keeps a good audit trail, of, of privilege activities that, that may need to occur. And then you need to reflect changes in roles and in access permissions. And this is again a usual challenge where SMBs, in for cyber essentials that that I've seen, companies trip up, which is everyone's very good at, usually very good at, creating and deleting accounts. Right? Because there's also financial incentives that I was speaking to. But, as, SMBs grow and people take slightly different roles, etcetera, it's sometimes not very easy to to take pause and reconsider. Do those people still need the same access permissions to the same systems, not that they're they're doing a a slightly different job. Right? So having a good process to, take stock when people are changing their roles due to the nature of SMBs and the growth that usually, SMBs are aiming to achieve, is particularly important to to put you in a good position to evidence, that these controls are operating. And on malware protection, this one is more self explanatory. So your devices, need to be protected against malware. That's usually done, through different types of measures, either the traditional, antivirus software that these days, they usually have more capabilities like firewalls, etcetera, or, even through things like endpoint protection software, that has more of a of a threat intelligence based onto that and a better understanding of the behavior on the host device. So those are all ways that you can, and measures that you can use to meet that requirement. In but you also need to consider that it's not just about the the protective measures themselves, but also the response. Right? So when, an alert comes up in one of those systems, you need to make sure that you have the ability to, to to actually respond. There's one particular challenge that we're, we're gonna speak at length, in the final slides, which is around BYOD. That becomes particularly complicated. Right? I mean, things come with malware protection. If you don't own the devices, so how are you going to do that? So we're gonna speak about that a bit later. But, if your mobile device if you have mobile devices that are accessing, your systems, And the, only exceptions, these days on the latest version of Cyber Essentials is, if you use a mobile device only to, to use, for instance, for an authenticator app, or for something like a text or video, then you do not bring need to bring them into scope. But if the personal devices, are used for, for for to do actual work, to access email, to access any type of, of business systems, then you do need to bring them into scope. Mario, can I actually interrupt you at at this stage actually? And under malware protection, there's invest in your threat intelligence. With many SMBs, they may not have the resources to do so or to understand how to get started in this. Could you just expand a a little bit about that? Yep. So the here, the the the key element is really, thinking about what threat intelligence man it means for in the context of an SMB. Right? So I'm privileged that I have a dedicated threat intelligence team, but that's usually not, something that most SMBs, will have. So what I mean by that is, to give you a very specific example, it is very common that that we that we see even, in in last pass that, some, personal email addresses end up on the, dark web monitoring services and credentials, that gets stolen in the period have I have I been pawned.com websites into the databases like that that track, breaches that happen externally. Right? So if you've got, something that really helps you on keeping track of, if your employees' identities appear in in those types of lists, Right? You you will then be able to to see if there could potentially be compromising or be a a contributor to decreasing the security posture of your organization. Right? So, different obviously, you need to adapt these types of measures to the size of your organization, to the resources you have available. But but having, products, that can help you, be a bit more proactive in kind of monitoring those things that are happening, across the world and usually end up in, in databases that are, that are happy, that are that are available to everyone, that are not paid even, will really increase your security portion, your ability to protect your assets. Super. I think we have a question about contractor devices. How do you handle contractors? Do you allow them access or we don't allow them access to sensitive information, but are they in scope? Yep. That's a very good question. So it it falls, again, under the same type of measures as BYOD. Contractors are slightly different because they, they will would usually be bound by, by some sort of contract. Right? So it depends if those contractors are coming from a consulting company where you may have an actual contract with them, and you can specify, on them, the types of, security measures that are expected. Right? For companies that, that bring, let's say, for lack of a better word, contractors off the street. Right? I think what you what you need to consider is, all of those things that are requirements in Cyber Essentials, right, such as model protection, making sure that you've got your updates, etcetera. What I've done for a company that a fintech company that I've helped going through Cyber Essentials a few years ago was, making sure that I had kind of a manual audit, in the and I asked them for evidence that they were meeting these requirements. And I just captured, all of that in, yeah, in a in a ticketing system. Right? So I asked, look, in order for you to work, we've got cyber essentials. Please, I need to make sure that you've got these measures in place. Can you provide some evidence that you're doing this? Right? And, that's how, yep, that's how we satisfied the auditors a few years ago on a on a similar requirement. Very good question. Do we have any other questions that we'd like to to address at this time, or shall we keep going? Let's keep going, and then we can come back to to q and I. But, yeah, we've got a team that is also looking at, at chat. So we as we see opportunities, we will stop and, and take pause to answer some questions that are coming in. So finally, the the last the the fifth area, in no particular order, but patching is very important, is, patching that is a that is a big theme. So in previous versions of cyber essentials, there was the the hard requirement of patching, critical or high severity vulnerabilities within fourteen days. So that's no longer a hard requirement, but it's a strong recommendation in the good security practice. Right? So the the main thing here so there are two elements, that will, that relate to this. You need to have the confidence and your teams need to have the confidence that they can actually patch software without breaking, your business. Right? And that is something that comes through practice. So one thing one position that I would advise all SMBs to to try and not find themselves in is, they're only dealing with patching in the context of addressing vulnerabilities. Right? Because they will typically imply you will not build them the the right type of practice or experience with the with your staff, to actually do it safely. So, first thing that you should do even before trying to do cyber essentials is get into the habit in establishing operational patching policy. Right? And once your teams are used to updating your your things, whatever they are on a on a regular basis, then, solving it for the security component of it becomes much easier. Right? Because you don't want to be dealing with these things only in the context of security because it's wider than that. It's stability, it's support. There's a lot of other business benefits on why you should be timely about your, about your patching. Another thing that I will usually say as well is, start implement the basic vulnerability management program. And what I mean by that is, if you've got the opportunity and the budget to acquire, vulnerability management software that can, alert you, in advance in centrally about all of the software that you have in place, usually, they will have agents that you deploy in your, in your laptops or in your servers. That would be an an amazing way to do that. If you don't, have those, those types of measures in place, at a minimum, you need to be sure that all of the software that you use, that you subscribe to their security patients, in security mailing lists, in making sure that your IT, the the folks that manage your IT are on top and are actioning, every time they receive those emails such that you can put yourself in the position to meet this requirement. Again, different sizes of organizations at different maturity levels, will deal with this problem in a different way, but you need to figure out something that, that is sustainable and affordable, in your own context. Indeed, it doesn't need to be all the bells and whistles. Right? You can start with the kind of being basic as long as you are diligent. In the in the game, going back to the process part, you need to have the processes and the yeah. You need to get used at doing these things, hopefully, not in anger and not when, when there's a critical vulnerability out there, like we had the big one this week and GYNX, early in the week. So, and another thing that will greatly put you in a good position to to evidence this requirement is, thinking of turning automatic updates on. Right? So if it's something that, that happens without you even having to worry about it, and if that's something that you can do, by all means, that's the usually the best way to go about it. Right? And the these are kind of the the key things, kind of from experience that, that I would share about these, the these, these these five requirements. So there's a lot that goes into this into aligning with the available resources and the expertise of your teams to to do this. Some of them, you may not be able to do yourself, and you may need an IT service provider to help you, with all of this. And, there's also a question a very good question that I think actually comes up very well in this section, so I'll address it now, about choosing a partner, right, that can help you through through, some of this. So also as part of the, the cyber essentials ecosystem, if I can call it that, there's also something that is called the cyber advisers. Right? So the NCSC, in Yasmeen, run by Yasmeen, they, they have this program where, cyber advisers need to take, particular training, to make sure that they are competent in helping organizations, navigate through some of these challenges. So as with every contracting, relationship, you need to be able to trust the people that you're gonna work with. Right? So, making sure that you ask a lot of questions, but in particularly try to see if, if the advice that you're being given is generic advice or is based on, asking thoughtful questions about your context and how they're trying to adapt their expertise to your environment. Right? So that's always the for me, even in my in my role these days, when I choose a consulting partner, that's what I go for. Right? Just the run of the mill generic advice is not super useful. If I can usually see the the quality of the support that I'm going to get by the thoughtfulness of the questions that I'm asked, about my use case, about my needs, in seeing that the person is making an effort. They're trying to adapt, what they know, to what I have. Right? So that would be kind of my my tip. Yeah. That that's actually an excellent point, Mario. Listen closely to the questions you are being asked about your use case. Exactly. So shall we do the next part? Yes. The journey, which is usually a journey. So the first part on going the journey is really making the business case. Right. So there are many ways to kind of think about, starting this journey. So we have usually, there are many reasons to to start, the consideration for cyber essentials. You may have some legal or compliance requirements. So usually, what I usually say to consider, this is the follow the data, type of principle. So if you have, if you deal with, with central government, if you there are schemes that mandated, like, gcloud and others, or even, for some charities in schools in the, those types of organizations, they sometimes get either grants, from the government or they deal with some type of government data, that may be, the that may be something that you need to consider, right, in having that legal and compliance requirement to do so. You may also find ourselves, with customer and partner requirements. So you're trying to sell to a customer that they tell you, look, we need to be compliant for x reasons, or they themselves are suppliers to the government. So they need to ensure that their own supply chain are helping them meet their requirements. Right? So those are usually, other types of motors that will make you consider, going through cyber essentials. And, we, other elements, also on risk reduction. So if your leadership team or your board of directors want to have some, some assurance of, how you are keeping, the, their investment secure, this is also a good a good entry level way, to provide them with that assurance. Right? And they're showing them a certificate that is being validated. You may do it for competitive advantage. So if you, if you are with three other companies, trying to bid for a particular contract and, you're the only one with this, then that's going to be, a differentiator, right, that you can potentially use in your marketing, etcetera. And there may be insurance benefits. So if you, are have cyber insurance, or something like that, certifications are also a way to try and argue for lower premiums, right, which, if you, are going through Cyber Essentials Plus, and you have less than, turnover less than 20,000,000, and you are domiciled in The UK, you also get access to to cyber insurance. Right? So that's also one of the benefits of the scheme. So the other element is around checking the reg readiness in your, gap analysis. So the NCSC website is, I've worked in a lot of different companies across the planet also as a consultant, and the NCSC writes the best, advice that, on the planet, particularly for SMBs. Right? So they've got really good readiness tools. And the questionnaires that you can go through that really tell you where you need to focus. Right? Based on very simple questions that I would advise everyone to to go and look at them. The scoping of your evaluation is particularly important. Right? Because you can either do it for your whole organization or for parts of it. Right? And there again will be coming on what's your what's your business case. Right? Your business case should help drive what that scoping look like looks like. Do consider that the benefits that I've mentioned on on cyber insurance, that, you will only get access to that if you the scope is your whole organization. If you, define the scope as just a part of it, you will not get access to, to that perk, let's say. Another element that is really important for cybersecurity overall, but is not a specific requirement, is good asset management. Right. That should also involve your software and firmware registers. So you can't you can't protect what you don't know you have. Right. So that's the the first rule of cybersecurity. I just made that up, but I think it sounds good. So let's stick with it. Let's stick with it. But, having a strong asset management is important for everything. It's important for, for your ability to to know if your investments, are being well spent, that the money, from the CFO perspective, is being put in the right place. It is also useful for things like depreciation, such that your balance sheets, are in the right place. So asset good asset registers are a precursor for very good things in business, and cybersecurity is no different. So having having those in place even before you start your your journey is, is super important. The, other element is around the, the self assessment. Right? So, again, I mentioned a number of resources on this NCSC website that you can start even without the cyber adviser or or having some external support. And, yeah, going through that to give you a bit of, of questions, is, is particularly important. We the other so after you do those two things and kind of have a better understanding of where you sit and what some of your gaps may be, then, would be my proposal is the time to engage with Yasmin and start choosing a certification body. Right? So in that, in that regard, as I mentioned before, right, try to speak to a few, see if there's someone that you can trust. See how thoughtful are the questions that they ask that they ask you about your organization and how they can support you. Yeah. I mean, that would be kind of a a good way to to start. In terms of certification bodies, they are they come in all different shapes and sizes, and I've seen we have a a number of them on chat, today as well. So I I there are some that's, that's specifying particular sectors. Right? So for instance, the legal space. There are others that, focus on particular areas. So they because they're local to, let's say, Manchester, they usually target businesses around the Manchester area, etcetera. So you can choose where you want to go. Right? The the main thing is always make sure that it's a partner that you can trust. Right? And, and that, that it's something that is, giving the assurance that they're gonna do the, the the best for you and your organization. They're gonna gonna help you and not just give you kind of generic advice, because, obviously, what we can do here because we're talking to so many people is largely the generic advice. But, if this that was not the case, there would be a lot of probing questions to kind of understand what's the driver, what do you have, how do you operate, and all of those things that are really important when you actually go through the journey. And then, after you do that, it's going to be the time to implement some of the required controls and policies that you may have been missing, right, that you're going to find at that stage. And they will usually come into into into spaces, which is, either policy updates. So policies and processes that you may need to put in place that you don't have, or, technical fixes. Right? So installing endpoint, so doing better patching, or whatever may be. So there may be some policies that you need to change, with regards to how you, handle device locking, for instance. All of those things will kind of come in the wash as you start going through the requirements one by one. And then finally, it's the part to submit all of that hard work either through the self assessment or booking the independent audit. Right? So, as Sanne mentioned at the beginning, there was a patch they're gonna check patch level, security configurations. They will perform vulnerability scanning, of your of your devices. Yeah. We can do all of those things to make sure that you are meeting all of the requirements. And after you go through all of that, then you finish the process. If all goes well, you will receive your certification, and then your certificate will be valid for twelve months. Right? So Cyber Essentials is something that we needs to be renewed every twelve months. And once you do that, now is the time to start boasting about it. You can put your Cyber Essentials badge on your website. You can add it to your marketing materials. You can update your sales pitches. So all of that good stuff comes after, after the work is done. There's a question here that I will address now regarding twenty seven zero one, ISO twenty seven zero one, which is, the so you sub essentials is a subset of the controls in ISO twenty seven zero one. Right? So ISO twenty seven zero one is, the management system certification that usually is more about risk management. Right? So it's more, even though it's more it is broader, it's not as, specific in some of the requirements, that exist. So I think they're a good complement to each other. But usually, companies go through ISO twenty seven zero one and SOC two type two like LastPass. We're so we are currently going through all that as well, when you've got contracts that mandate that you do so. Right? So it's a similar type of business case, as a general rule. Okay then. Shall we continue? So, with regards to cyber essentials in LastPass, so where does the Last Pass product, help or where it can it help? So, before going to, going on this part is, we need to just say that, in Cyber Essentials, there's usually a level of optionality, right, on some on how some of these. So, the first versions of these slides, we had all of the text, but my marketing team didn't like that. So we had to trim it down and make sure that we talk about the subject instead. But, one of the things Can I just sorry? Sorry, Mark. Can I just inter, interlude here? And all of this is available, in a document that we will be sharing at the end, which is the IT infrastructure version 3.1. Yeah. And they're they're all be linked. So in terms of protecting your, your passwords against brute force, Right? You can do it in a number of different ways according to the, to cyber essentials. Multi factor authentication, throttling of the the rights that people, can, can authenticate. Yep. And so there are many different ways of of meeting that. That's something that how, LastPass can help with. So by default, we have eight unsuccessful login attempts. In the auto fill feature also minimizes all that need for manual logins. Right? So that increases the likelihood of you not even hitting any of those limits. We obviously have the secure password storage, that relate towards your knowledge architecture. That, LastPass never holds the, the the password that client set for for for the secure vaults. And you also need to use technical controls to manage the quality of your passwords. So this that's where, the built in password generator that you can define centralized policies for can help. So we, between twelve and sixteen is usually what we recommend as a best practice, and that can all be generated on the fly without your users even having to know, what your passwords are. And it also helps you easily sync, passwords across your devices. Right? So if you've got a mobile device that our company provided, your laptops, etcetera, it can bring all of those things together. According to the standard, the the complexity needs to be at least, 12 characters, or eight with automatic blocking of common passwords. Right? So depending on, so depending on your business and the other requirements you may have, those are kind of different ways that you can meet the requirement and improve your security as well. So LastPass effectively exceeds those? Correct. So other elements is, we, the, the standard itself recommends credential resets only when passwords are compromised. So this has been the guidance from NIST for a long time now. And so the security dashboard, in LastPass product helps you monitor that password security. And it also has the elements that I mentioned at the that we mentioned at the bottom, such as credential and dark web monitoring capabilities. Right? So those are things that, can give you as an IT administrator or security person at a at a smaller company, the ability and the alerts such that you know if your credentials of your employees have been, have been compromised, which is also a benefit of acquiring a LastPass business licenses, either you also get, personal licenses. Right? So your users can start getting that look and feel that becomes important from a human risk perspective. And also multifactor authentication. So we support SMS, but also, FIDO keys and, hardware tokens and authenticators. And we have our own authenticator app as well. And those are much stronger ways to to deal with, with, with the requirement of having multifactor authentication. So LastPass obviously provides in terms of policies, provides much more capabilities, but these are some of the capabilities that directly map and help you meet the requirements within Cyber Essentials. Super. Thank you. Thank you, Mario. I'll jump in here very quickly in just a few words on some considerations from a human risk perspective. Up until now, we have been talking about the technology part. We've been talking about the process part, but I'd also like to in introduce the people part and what do we do. This is an exciting scheme, exciting process that we're going on. Let's bring our people with us. I think when we speak about human risk, we often think about that humans are the greatest risk, but and, for discourses within across our industry or as our humans being the weakest link, but I think humans are the greatest link, your your strongest link if you train them, if you bring them on board during this process. Because as Mario mentioned before, during this process, policies may change, processes may change, and you do want your your people aware of these changes. And and moving away from security is telling us to do this, or security is doing this to us and affecting my working working day, in these ways, instead by explaining, and going going through the explanations of why and making us more secure. In addition to this, I'd like to highlight just minimizing this reactance. When there are changes that are happening, such as removing admin accounts, this may affect somebody. Some some people within your organization or removing end of life software or redundant apps. We don't we want to minimize this reactance and this improve this understanding, that these behaviors, and these changes are for, the greater secure good. Also, I wanted to highlight this. This is not, not on the n NCSC site at all, but this is a different perspective to what we've been talking about today. This is from security behaviors database, which is put together by, industry, leaders and academics, and it identifies these five areas which are the, most the risk reducing behaviors. And if you look at them, we've spoken about strong passwords, MFA. These are things that LastPass can aid you with. But also in terms of your opportunity for awareness and training, you can improve your other areas of these behaviors as well. And from, an educationalist point of view, I would say bring them on board, and also but focus on the behaviors that you would like changing, and this would be a good starting point for you. So I just wanted to highlight that at the end of our, webinar. The next slide on some advice on overcoming common challenges. Mario, did you want to speak on this? Yep. So the so this is again from, from from, my my experience. Right? So managing end of life assets and software is sometimes a challenge. Right? So if there's if there isn't usually a strong kind of business reason, SMBs in particular tend to use their, their their devices and their and their assets to the longer of their ability such they can focus, the limited resources in things that will grow the company. Right? So having a good process on how to manage end of life assets in the in software is very, very important. So, again, things like, making sure that you are signed up to, to the mailing lists of all of the vendors that you use, and someone in IT or security capacity knows what those look like. And, so not something that is particularly mandated by, by sub essentials, but having a kind of a risk management program, right, or a risk management approach where you can bring that up into your leadership as something that needs to be dealt with is usually the way that I suggest that, that IT administrators and security people, address this at the at the executive level. Right? To make sure that there's visibility about how this can impact things such as your certifications if you are going to pursue them as well. Another common problem is the untimely application of patches. Right? So, sometimes there are people come in two different shapes and sizes, form with regards to the patching, generally speaking. There are those that are trying to do, auto updates on everything, until it breaks, and then they think they might change their strategy. There are others that are always, afraid about, about the potential impact and never do even try any type of, auto updates. I think there are benefits of being on each corner, and there are challenges and things that come from being at each of the corners. But, but, trying to optimize for something that is more hands off, particularly on our laptops, etcetera, is something that I would strongly recommend that you start by trying auto updates. If you see that you actually have, impact in a particular product or particular things, then look, do go back and, and revisit that. But the more you can, build the confidence within your organization that, to see if auto updates are are something that is, that is safe, to have enabled. That will pay off in terms of time and attention that you want to be spending on other things other than patching your software. Right? So I would always highly recommend to to try, but it may not always be possible. So making sure that you've got better timeliness. Right? So, again, we talked about the fourteen days even though not not an absolute requirement is super important. Having, if you receive a critical vulnerability notification on your email and then someone doesn't look at it for two months, there's gonna be a problem. Right? It's gonna be a problem for you to attain your certification, and it's going to be a problem for you to renew your certification. So making sure that you you are on top of, of those types of things and follow-up, regularly on them, and you don't leave them, yeah, unattended, it's super important to make sure that you that you can that you can do that, safely. On bring your own device, this is a a particularly big problem. Right? Which is, there there are two there are two components to, to this, which is, you, need if people are bringing their own, devices, you may not have the ability to deploy software on them. Right? So the way that I've personally dealt with this in, in other organizations was, I I explored three different types of, of options. Right? Which is either, give, the employees a software that they can install, which some users will be okay with that, others won't. Right? And they will think that it's potentially overstepping, from the organization perspective. And that's the typical, mobile device management software. There are alternatives such what is called mobile threat detection, which usually it gives you a green or light. It just says that if you're having your patches and they've got all the protection on. Right? So I implemented something like that for a fintech organization that I worked with a number of years ago, where I showed everyone in the company, look. This is all I can see from the admin console. We're not monitoring you. There's no way that we can see what what happens there. In the that, yeah, let a lot of people be more, okay with having some kind of software installed. There are other options such as deploying software that separates the personal in the, in the, in the professional component. But, again, not everyone will be happy with that. And particularly now France and Portugal in particular are having some kind of tighter employment laws on people not being bothered out of working hours that may, get some employment law issues that you may need to to navigate. But in the last thing that you can that you can do is is really making sure that, if you cannot secure and you don't have manual audits such as, what I did at that company was whoever didn't want to do it in order to use their device, for work stuff, They needed to, on a quarterly basis, provide some, some evidence that their devices were patched. They had working software, protection software, and all of those types of things. And some of them decided to do that. If not, you need to have a hard stance on not allowing people to to to use their devices for work, and you need to have mechanisms to validate that they're not using their personal devices for work. Right? Such as, kind of periodic review of logs, to make sure that people are not doing that. But it is a complication and it is a challenge, to do. And finally, we have, the the element around the year one reassessment. Right? So at the end of the first year and this is a big difference because it's usually very easy to attain security certifications, whether that's cyber essentials or ISO or or whatever may be the case. Renewing them is much more complicated. Right? Because at the renewal, you're gonna need to to show how you've been operating all of those controls throughout the whole period. Right? And that becomes more complicated. So all of those things you said you're going to do, you're gonna be measured on how you've actually done them. Right? So, yeah. So that's another thing to take in consideration as you implement some of these practices and making sure that you've got the right advice to make them sustainable in the context of your organization. Right? That's why choosing good advisors is, is very, very important. That is all that we had for you. Super. Actually, before we go, thank you very much for your questions, and hopefully, we have been able to answer most of them. We have one minute left in in this webinar, but just some useful tips to get you started and kind of a wrap up. The document that we have referenced during this webinar is the cyber essentials requirements for IT infrastructure version 3.1, and I did notice somebody in the chat did actually, there we go. Thank you very much, Jess. That's the one. And and a few other tips to get started if you're not on this journey yet. And, just to highlight what Mario said, the asset management, process. Get that going. It's useful in this, these five control areas and useful for all sorts of things as we have reviewed. And this will assist you in defining your scope. Also investigate, password managers, last word last pass capabilities. Also, the NCSC has excellent blogs on password managers in general, as well as MFA, which is selecting one which is suitable for your business. But LastPass, is committed to ensuring that, that we supply you all the information that you need to make make those, decisions on your journey. So, Mario, final words for you? No. Thank you very much for, for joining us. So this was meant more as, as a general part. It's particularly important for for SMBs, and it's not just about the the cyber essentials. Right? It's about those five key areas are really they're the the five areas that the NCSC focus on because they're the ones that really do make a big, big difference in our security posture. So, thank you for for joining us. Hopefully, it was, it was, informative as well. And, yep, And best of luck if you're, really thinking about pursuing cyber essentials. And, yep. And, thank you very much for joining us. Goodbye, everyone. Thank you.